CVE-2025-54417 Craft contains a theoretical bypass for CVE-2025-23209

What is CVE-2025-54417?

CVE-2025-54417 is a medium-severity command injection vulnerability in Craftcms Craft Cms, published on 9 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-23209: "Craft CMS has a potential RCE with a compromised security key". To exploit this vulnerability, the project must meet these requirements: have a compromised security key and create an arbitrary file in Craft's /storage/backups folder. With those criteria in place, attackers could create a specific, malicious request to the /updater/restore-db endpoint and execute CLI commands remotely. This issue is fixed in versions 4.16.3 and 5.8.4.

Weakness: CWE-94

Which versions are affected by CVE-2025-54417?

4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.

Products include Craftcms Craft Cms.

How do I fix CVE-2025-54417?

Upgrade craftcms/cms to a fixed version for your release line: 4.16.3 or 5.8.4.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-54417 being exploited?

There is no known exploitation of CVE-2025-54417 in the wild and no public exploit code.

Other vulnerabilities in Craftcms Craft Cms

• CVE-2025-32432 Craft CMS Code Injection Exploited Critical 10.0
• CVE-2024-56145 Craft CMS Code Injection Exploited Critical 9.3
• CVE-2025-23209 Craft CMS Code Injection Exploited High 8.1
• CVE-2025-35939 Craft CMS External Control of Assumed-Immutable Web Parameter Exploited Medium 6.9
• CVE-2023-41892 Craft CMS Remote Code Execution vulnerability Critical 10.0

All Craftcms Craft Cms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2vcf-qxv3-2mgw.